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The Information Commissioner (“the Commissioner”) has decided to 
issue Domestic Support Limited (“DSL”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is in 
relation to a serious contravention of regulations 21 and 24 of the 
Privacy and Electronic Communications (EC Directive) Regulations 2003 
(“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


DSL, whose registered office is given above (Companies House 
Registration Number: 08916306) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 
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Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 
promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have notified the company that they 


do not object to receiving such calls from it. 
Regulation 21 paragraph (1) of PECR provides that: 


"(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


"(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 
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(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 
being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 
7. Regulation 24 of PECR provides: 


(1) Where a public electronic communications service is used for the 
transmission of a communication for direct marketing purposes 
the person using, or instigating the use of, the service shall 
ensure that the following information is provided with that 


communication - 


(b) in relation to a communication to which regulation 21 
[or 21A] (telephone calls) applies, the particulars 
mentioned in paragraph (2)(a) and, if the recipient of 
the call so requests, those mentioned in paragraph 


(2)(b). 


(2) The particulars referred to in paragraph (1) are - 
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(a) the name of the person; 


(b) either the address of the person or a telephone 


number on which he can be reached free of charge.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The Telephone Preference 
Service Limited (“TPS”) is a limited company which operates the 
register on the Commissioner's behalf. Businesses who wish to carry 
out direct marketing by telephone can subscribe to the TPS for a fee 


and receive from them monthly a list of numbers on that register. 


Section 122(5) of the Data Protection Act 2018 (“DPA18”) defines 
direct marketing as “the communication (by whatever means) of 
advertising or marketing material which is directed to particular 
individuals”. This definition also applies for the purposes of PECR (see 
regulation 2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of 
the DPA18). 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


13. 


14. 


15. 


© 
ICO. 
Information Commissioner's Office 
"(1) The Commissioner may serve a person with a monetary penalty if 
the Commissioner is satisfied that — 
(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 
Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 
(a) knew or ought to have known that there was a risk that 
the contravention would occur, but 
(b) failed to take reasonable steps to prevent the 


contravention. 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 
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Background to the case 


DSL first came to the attention of the Commissioner following the 
identification of a particular Calling Line Identifier (“CLI”) which was 
linked to complaints made to the TPS and the Commissioner's own 
Online Reporting Tool (“OLRT”) between January 2020 and June 2020. 


The Commissioner sent a Third-Party Information Notice (“3PIN”) to 
the Communications Service Provider (“CSP”): BE A 
for the CLI in question on 15 July 2020 requesting the identity of the 
CLI’s subscribers. The response, which was received on 7 September 
2020, identified the subscriber as DSL, and provided a list of CLIs 


allocated to DSL with the respective connection date for those CLIs. 


The Commissioner conducted a search for complaints to the TPS/OLRT 
in relation to the CLIs disclosed, and found that there had been three 
complaints to the TPS and two complaints to the OLRT spanning 14 
January 2020 and 17 June 2020, however none of those complaints 
named DSL as the caller, rather they identified the caller as 
“Homeforce”, “Homeforth”, or some similar variation, with the calls 


seemingly involving the advertising of insurance products. 


The Commissioner sent a further 3PIN to [J on 8 December 2020 
to establish the Call Detail Records (“CDR”s) for the CLIs attributed to 
DSL between 1 January 2020 and 31 July 2020. A response was 
received that day from which provided the CDRs. It was 
apparent from the information provided that during the relevant time 
there were eight CLIs allocated to DSL which were being used to make 
calls: 441237875012; 443301138650; 443301139250; 
443301139950; 443330113350; 443330115850; 443330147628; and 
443330147629. 
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The complaints received in relation to calls from these CLIs between 1 
January 2020 and 31 July 2020 included the following: 


- When challenged as to whether they were already my service 
provider the girl admitted this was a courtesy call. I then asked if 
she was aware of and [sic] registered with TPS, she stated probably 
so I explained to her the company would be reported for unsolicited 


call to a number registered with TPS 


- Cannot find them on the internet. Tried putting in Homeforth, also 
Holmforth, could not find anything. Tried Companies House but 
nothing. Tried ringing number, but company does not receive calls 
on the number they used. I have registered with TPS in 2005 and 


still getting a load of cold calls, please stop them 


- We should not be receiving unsolicited sales calls. We are savvy 
enough to refuse them; people who are older or less savvy run the 


risk of being conned into taking unnecessary insurance cover 


- Wanting to give discount on my plumbing and drainage insurance, 
which I did not have with this company. they asked for a password 
and it I would suspect have gone further if I hadn't intervened....I 
could see where this conversation was going. Probably asking next 
for bank details 


The Commissioner calculated the number of calls which had originated 
from CLIs attributed to DSL between 1 January 2020 and 31 July 2020 
and established that there had been 89,959 calls made in total. 
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The Commissioner conducted Open-Source Research into DSL and 
identified a website which could be linked to the company: 


www.domesticsupport.co.uk, however by 14 December 2020 this 


website no longer appeared to be active. 


The Commissioner sent an initial investigation letter to DSL at its 
registered office address on 17 December 2020. This letter was 
returned to the Commissioner on 8 January 2021 marked ‘return to 


sender’. 


Using information obtained via the Commissioner's Intelligence 
Department, the Commissioner was able to ascertain the residential 
addresses for two company directors, and on 28 January 2021 he sent 
investigation correspondence to the individuals in their capacity as 
directors for DSL repeating the questions first asked in his 
correspondence of 17 December 2020. These letters were ‘signed for’ 
on 29 January 2021. 


On 2 February 2021 a response was received from 
admin@domesticsupport.co.uk. This response did not address the 
Commissioner’s specific questions, but instead made broader 
statements in respect of the Commissioner’s enquiries. The response 
stated that DSL purchased data from third parties that “had already 
pre-screened it for TPS”. DSL also stated they would “then compare it 
to the in-house suppression list to further remove any numbers for 
TPS, and for all other reasons. Finally, Domestic Support would then 
use a paid-for online TPS screener to complete our own TPS screening. 
Domestic Support felt confident that this three-level approach would 
ensure that any and all numbers that were on TPS would be removed". 
DSL stated that it “no longer makes any sales or marketing calls 


whatsoever. The only calls that are made by Domestic Support are to 
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administer existing customers with their existing products that they 

hold with us, or to call existing customers back upon their request. This 

has been the case since 315 August 2020". DSL was unable to confirm 

details of the CLIs used, stating that “We believe that the company 

numbers on your attached letter could have been from a previous 

phone system via a. Unfortunately the director that dealt with 

| was the named person on the account, and all the associated 

telephone numbers, has now left Domestic Support. As such we cannot 

gain entry into this now cancelled and removed phone system to 


confirm these”. 


Further enquiries were sent to DSL on 3 February 2021, repeating the 
questions which remained unanswered, and also asking for additional 
information including about the sources of the data used for DSL’s calls 
at the relevant time. The Commissioner also asked for an explanation 
of why calls emanating from CLIs attributed to DSL appeared to have 
named “Homeforce” (or similar), noting that the Directors themselves 
are ‘persons with significant control’ of a company called ‘Homeforce 
Services Ltd’ (which at the time of the alleged contravention shared the 
same registered office address of DSL). The Commissioner wished to 


understand the relationship between the two entities. 


In its response DSL confirmed that it was indeed unable to provide 
details of the CLIs used at the time, or details of the volume of calls 
made by DSL between 1 January 2020 and 31 July 2020. DSL did 
however confirm that it used two Third-Party Data Providers to obtain 
the data which would have been used for its calls (BEE and 
"B - seferred to hereafter collectively as the “Third-Party Data 
Providers”), but failed to identify the sources from which those Third- 


Party Data Providers actually obtained the data. 
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DSL advised that “/cJurrent telephone numbers used and in service 
are: 01243 839590. Existing customers can call us (inbound only) on 


0844 41 45 202, which links to this phone number. The 01243 839590 
phone number is held by iil’. 


In response to the Commissioner’s request for any contracts between 
DSL and its Third-Party Data Providers, and details of its due diligence 
checks, DSL simply stated that “/t/he [Third-Party Data Providers] 
provided us with data pre-screened for TPS. We then removed any 
data from our suppression list, and then performed our own TPS check, 
thus giving any data a three-level check for TPS and other reasons”. 


No contracts were provided. 


In answer to the Commissioner’s request for an explanation of the 
relationship between DSL and Homeforce Services Ltd, DSL stated that 
it “has not ever shared any data with any company for any reason 


whatsoever, nor will it do so in the future”. 


The Commissioner asked some follow-up questions relating to, inter 
alia, the consent held for its direct marketing calls, the domains used 
by the Third-Party Data Providers, and the relationship between DSL 
and Homeforce Services Ltd (noting the unsatisfactory response 
received previously). In response DSL stated “/r/egarding consent to 
make the calls: We would previously purchase data from the data 
companies provided in the previous email, these providers assured us 
that they are TPS compliant, and that all numbers were screened from 
TPS. Following this we would perform two further checks, by way of 
comparison with our suppression list, and then a further TPS check 
with an online provider. As we would only use data once as per our 
contract agreement with the data provider(s) the data was then 


removed from all our systems. This means that I cannot unfortunately 
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therefore give you details of the specific data company that provided us 


with the specific numbers detailed in your correspondence, as we have 


removed all the records from that time. I trust this makes sense". 


DSL failed to provide details of the domains used by its Third-Party 
Data Providers and, in response to the Commissioner’s request for a 
copy of the consent statements which individuals would have been 
presented with, DSL said simply “we do not collect data, any and all 
data previously used by Domestic Support Ltd was obtained from data 
companies”. Regarding the relationship with Homeforce Services Ltd, 
DSL stated “Domestic Support Ltd and Homeforce Services Ltd are not 
directly linked, Homeforce Services Ltd is a different and separate 
venture, which is looking to provide online household services”. No 
explanation was given for why calls emanating from CLIs attributed to 
DSL appeared, from the complaints received, to be identifying 
themselves as “Homeforce”, with DSL stating just that it “did its utmost 
to ensure that nobody registered with TPS was called for any reason 
whatsoever, by way of the checks previously mentioned. Whilst 
Domestic Support Ltd was undertaking tele-marketing our staff were 
fully trained to ensure that the customers knew exactly who was 


calling, and checks were performed to ensure this was upheld”. 


The Commissioner issued separate 3PINs on 10 February 2021 to the 
CSPs for the two numbers disclosed in DSL’s response: [nn 


(regarding the CLI: 01243839590), and] (regarding 
the CLI: 08444145202). 


In subsequent correspondence, DSL said of its two known Third-Party 
Data Providers that “ strictly comply with ICO code, DMA code 
of practice and the EU Communications Act [...]"; and “i: 
Underwent a full data audit, link to which is attached, which we fully 
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researched before purchasing any data. This fully details consent given 
by data subjects. The research we performed, coupled with ICO, DMA 
and GDPR certified logos and details ensured we were purchasing 
compliant data for use. og rw DSL 
separately attached a copy of a standard factsheet in relation to its first 
Third-Party Data Provider, and an unsigned invoice dated 25 August 
2020 (i.e., outside of the period of contravention) for the purchase of 


3,000 records of homeowners aged between 55 and 75. 


On 11 February 2021 the Commissioner received a response from 
E in relation to his queries of 10 February 2021, specifically 
regarding the CLI: 01243839590. ME identified the subscriber of 
that CLI as RE (which the Commissioner notes at the time 
of the alleged contravention shared the same registered office address 


as both DSL and Homeforce, and has the same two directors as DSL). 


On 12 February 2021 the Commissioner received a response from 
= in relation to his queries of 10 February 2021 specifically 
regarding the CLI: 08444145202. E confirmed that the 
subscriber to this CLI was DSL. 


Noting DSL’s earlier claim that it had ended its contract with BE, 
the Commissioner sent J a request for details of the end-date of 
CLI allocation for those CLIs identified on 8 December 2020. SS 
response of 16 February 2021 indicated that the end date for 17 of the 
23 CLIs first identified on 7 September 2020 as being allocated to DSL 
was 31 October 2020; 6 of the 23 CLIs remained allocated to DSL until 
31 January 2021. 
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On 18 February 2021 the Commissioner repeated his request to DSL 


for details of the sources used by the Third-Party Data Providers when 


obtaining the data which would be purchased by DSL. 


Until 26 March 2021 DSL was unable to provide any substantive 
response to the Commissioner’s enquiries, citing a lack of cooperation 
from its Third-Party Data Providers. When DSL did provide a response 
it included an extract of an email response it had received from one of 
its Third-Party Data Providers i) which stated that: 


“[t]he lawful basis for processing was legitimate interest. 


ae a reseller of one of the larger data aggregators in the 
UK. They source the data from a variety of sources, predominantly 
websites. As per GDPR everyone that signs up is informed of how their 
data will be used. The exact websites and our data aggregator is 


commercially sensitive information. 


All records were TPS checked on output and licenced to you for a single 
use within 3 months of 20/08/2020.” 


On 28 April 2021 the Commissioner sent an ‘end of investigation’ letter 
to DSL. However, on 10 May 2021 a further request for information 
was sent to DSL requesting evidence in respect of its TPS checks. DSL 
responded the same day to advise that it used an online provider called 
SSS ee Following a request for copies of 
service invoices between DSL and MMM between the period of 1 
January 2020 to 31 July 2020, DSL provided an invoice dated 13 


January 2020 for qq in the sum of £1,152, 


and an excel spreadsheet purporting to show two payments: the one 
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from 13 January 2020 and an additional payment of £436 on 12 March 
2020. 


The Commissioner contacted [EM to request details of the checks 
carried out on DSL’s behalf. MMM initially responded to advise that 
an account could be found using the relevant email and postal 
addresses provided by the Commissioner, but that the company name 
on the account differed from DSL. The Commissioner advised that DSL 
may have used a different trading style, and asked for information 
“using any or all of the identifiers” which the Commissioner had 
provided. IMJ subsequently provided a spreadsheet which 
showed that it had charged for the processing of 80,318 ‘records’ 
between 13 January 2020 and 2 June 2020. It is not clear what 
identifiers were used by | Q reaching the figure provided 
within the spreadsheet, i.e. whether these 80,318 records were 
checked specifically on behalf of DSL, or one of the other organisations 
with links to DSL’s directors which resided at the same registered office 


address. 


Notwithstanding these checks, an examination by the Commissioner of 
the 89,959 calls made from the eight CLIs specifically attributed to DSL 
by its CSP, MMM, between 1 January 2020 and 31 July 2020, 
revealed that 69,133 calls were made to subscribers whose telephone 


number had been registered with the TPS for not less than 28 days. 


On 29 September 2021 the Commissioner sent a further set of 
enquiries to DSL, with evidence of the 69,133 calls which were alleged 
to have been made to TPS-registered subscribers from DSL’s CLIs, 


inviting DSL to provide an explanation for them. 
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In response, DSL stated that it could not confirm whether it made the 

calls, but that “Domestic Support Ltd are the only company or 

organisation to have used the above mentioned CLIs, and certainly no 

other organisation had access to that particular phone system. This 

suggests that Domestic Support Ltd did make these calls, as it would 

be impossible for any other company to use the CLIs”. DSL was asked 

to explain again why ‘Homeforce’ was named by the complainants, to 

which it responded that “As it was only Domestic Support Ltd that used 

the aforementioned CLIs we cannot directly explain why a complainant 

used a different company name, however we can, from experience, 

suggest that many customers do from time to time not record the 


correct information”. 


In respect of the 69,133 unsolicited direct marketing calls attributed to 
it, DSL has to date been unable to evidence that the subscribers 


receiving them had not objected to receiving its direct marketing calls. 


The Commissioner is satisfied that the 69,133 calls were all made for 


the purposes of direct marketing as defined by section 122(5) DPA18. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 
The Commissioner has considered whether those facts constitute a 
contravention of regulations 21 and 24 of PECR by DSL and, if so, 


whether the conditions of section 55A DPA are satisfied. 


The contravention 
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The Commissioner finds that DSL contravened regulations 21 and 24 of 
PECR. 


The Commissioner provisionally finds that the contravention was as 


follows: 


Between 1 January 2020 and 31 July 2020, DSL used a public 
telecommunications service for the purposes of making 69,133 
unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 


accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 69,133 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and who for the purposes of regulation 21(4) had 


not notified DSL that they did not object to receiving such calls. 


For such notification to be valid under regulation 21(4), the individual 
must have taken a clear and positive action to override their TPS 
registration and indicate their willingness to receive marketing calls 
from the company. The notification should reflect the individual’s 
choice about whether or not they are willing to receive marketing calls. 
Therefore, where signing up to use a product or service is conditional 
upon receiving marketing calls, companies will need to demonstrate 
how this constitutes a clear and positive notification of the individual’s 


willingness to receive such calls. 


The notification must clearly indicate the individual’s willingness to 


receive marketing calls specifically. Companies cannot rely on 


16 


55. 


56. 


57. 


Information Commissioner's Office 


individuals opting in to marketing communications generally, unless it 


is clear that this will include telephone calls. 


Further, the notification must demonstrate the individual’s willingness 
to receive marketing calls from that company specifically. Notifications 
will not be valid for the purposes of regulation 21(4) if individuals are 

asked to agree to receive marketing from “similar organisations”, 


"N 


“partners”, “selected third parties” or other similar generic descriptions. 


Whilst there is evidence to suggest that DSL, or at least one of the 
separate legal entities which held DSL’s registered office address as its 
own at the time, were carrying out some TPS checks on data, there is 
no explanation provided for why CLIs which DSL accepts were in use 
exclusively by itself at the material time were used to make 69,133 
unsolicited calls to individuals who had been registered with the TPS for 


not less than 28 days. 


DSL has been unable to provide any evidence that the subscribers who 
received these calls had notified DSL that they did not, for the time 
being, object to such calls. Indeed, it is apparent from the 
Commissioner's investigation that DSL is unaware of precisely where 
the data which it purchased was even sourced. Following a prompt 
from the Commissioner, DSL took steps to liaise with its Third-Party 
Data Providers to obtain details of the domains/websites used, and 
evidence of notification that subscribers did not object to calls. The 
result of those enquiries was a single response from one of the Third- 
Party Data Providers stating that “The exact websites and [its] data 
aggregator is commercially sensitive information”. The Commissioner's 
direct marketing guidance is clear [at paragraph 106] that 
“Organisations should [...] make sure that they keep clear records of 


exactly what someone has consented to. In particular, they should 
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record the date of consent, the method of consent, who obtained 
consent, and exactly what information was provided to the person 
consenting. They should not rely on a bought-in list unless the seller or 
list broker can provide these details. Organisations may be asked to 


produce their records as evidence to demonstrate compliance in the 


event of a complaint.” 


The Commissioner is therefore satisfied that there is evidence of 
69,133 unsolicited direct marketing calls being made by DSL to 
subscribers who had been registered with the TPS for not less than 28 
days, and who had not previously notified DSL that they did not object 


to receiving such calls. 


Further, as the complaints indicate, DSL failed, as required by 
regulation 24 of PECR, to provide the recipient of the calls the 
particulars specified at regulation 24(2) of PECR in that there is 
evidence that the calls from DSL’s CLIs identified the caller as a 


variation of ‘Homeforce’: a separate legal entity to DSL. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulations 21 and 24 by DSL arising from the organisation’s 
activities between 1 January 2020 and 31 July 2020, and this led to 
69,133 unsolicited direct marketing calls being made to subscribers 
who were registered with the TPS and who had not notified DSL that 


they were willing to receive such calls. A total of 5 complaints were 
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received in relation to DSL’s activities over the relevant time, with the 


complaints suggesting that DSL provided inaccurate information as to 


its identity. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner considers in this case that DSL did deliberately 
contravene regulations 21 and 24 of PECR. It is noted that despite 
some checks being carried out, there is sufficient evidence to suggest 
that DSL conducted a large number of unsolicited direct marketing calls 
to TPS-registered individuals, and made no apparent effort to establish 
that those individuals did not object to receiving such calls. The 
Commissioner is particularly concerned that the apparent use of 
different company names during its calls suggests that DSL was 


deliberately attempting to deceive individuals as to its identity. 


For the above reasons, the Commissioner is satisfied that this breach 


was deliberate. 


Further and in the alternative, the Commissioner has gone on to 
consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 


Firstly, he has considered whether DSL knew or ought reasonably to 


have known that there was a risk that this contravention would occur. 
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This is not a high bar, and he is satisfied that this condition is met. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
any subscriber registered with the TPS, unless the subscriber has 
specifically notified the company that they do not object to receiving 
such calls. In case organisations remain unclear on their obligations, 
the ICO operates a telephone helpline. ICO communications about 
previous enforcement action where businesses have not complied with 


PECR are also readily available. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 

to believe that DSL would have received a notification from the TPS for 
each of the complaints being made in this case. That there were three 
complaints made to the TPS alone over the period of the contravention 
should have made DSL aware of the risk that such contraventions may 


occur and were indeed occurring. 


It is therefore reasonable to suppose that DSL should have been aware 


of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether DSL 
failed to take reasonable steps to prevent the contravention. Again, he 
is satisfied that this condition is met. 


The Commissioner’s direct marketing guidance makes clear that 


organisations utilising marketing lists from a third party must 
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undertake rigorous checks to satisfy themselves that the personal data 

was obtained fairly and lawfully, that their details would be passed 

along for direct marketing to the specifically named organisation in the 

case of live calls, and that they have the necessary notifications for the 

purposes of regulation 21(4). It is not acceptable to rely on assurances 

given by third party suppliers without undertaking proper due 

diligence. It was not until the Commissioner began his investigation, 

and pressed DSL to provide details of the data sources, that DSL took 

steps to engage with its Third-Party Data Providers to obtain this 

information. These attempts were unsuccessful, so it is clear that at 

the time of purchasing the data DSL cannot have had any awareness of 

the circumstances under which the data was obtained from individuals, 

and could not therefore have been assured that they would have 


agreed to be contacted by DSL. 


Reasonable steps in these circumstances may also have included 
conducting thorough TPS checks on all of the data it was to use for its 
direct marketing campaigns; or at least obtaining and recording 
evidence of notification from those TPS-registered individuals whom it 


intended to contact prior to engaging in its direct marketing calls. 


Given the volume of calls in contravention of Regulation 21 PECR, it is 


clear that DSL failed to take those reasonable steps. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has taken into account the following aggravating 


features of this case: 
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The Commissioner is concerned by the sole data-purchase invoice 
which was produced during the investigation which showed that DSL 
was purchasing records for homeowners specifically aged between 55 
and 75 years old, which would indicate that older individuals were 
being targeted. The fact that this invoice post-dates the period of 
contravention has been considered by the Commissioner, however he 
considers that DSL’s earlier general practices can be inferred by its 


content. 


DSL acted deliberately in contravention of PECR with a view to 


generating an increase in profit and turnover. 


DSL’s co-operation with the Commissioner was lacking at points in that 
it failed to thoroughly answer the Commissioner’s specific questions, 


requiring further follow-up investigations. 


The Commissioner notes the evidence that DSL did appear to screen 
some data against the TPS register via a third-party, however he does 
not consider that this constitutes mitigation for the contravention which 


took place. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out his preliminary thinking. In reaching his final 
view, the Commissioner has taken into account the representations 


made by DSL on this matter. 
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The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, he 


should exercise his discretion so as to issue a monetary penalty 


The Commissioner has considered the likely impact of a monetary 
penalty on DSL Using publicly available information, and the 
representations made by DSL in response to the Notice of Intent. He 
has decided on the information that is available to him that a penalty 
remains the appropriate course of action in the circumstances of this 


case. 


The Commissioner's underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 
telephoning consumers who are not registered with the TPS and/or 


specifically indicate that they do not object to receiving these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 
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Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £80,000 (eighty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 13 April 2022 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
12 April 2022 the Commissioner will reduce the monetary penalty by 
20% to £64,000 (sixty-four thousand pounds). However, you 

should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 
against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 
of the date of this monetary penalty notice. 


Information about appeals is set out in Annex 1. 
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91. The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 
penalty has not been paid; 

e all relevant appeals against the monetary penalty notice and any 
variation of it have either been decided or withdrawn; and 

e the period for appealing against the monetary penalty and any 


variation of it has expired. 


92. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 
Dated the 14t" day of March 2022. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 


his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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